Ruling: IP address does not identify person

[HarryT]

Originally Posted by JoeD

However, when it comes to issuing a fine or court proceedings, I really think they need something more than just the IP. That unfortunately may mean we need laws allowing the police to seize or search computers for IP related offences. An IP address should only be used as a means to allow the police to obtain more detailed information.

When the police seize a computer for forensic examination, it's not uncommon for the owner to be without it for a year or more (apparently there's a huge backlog at the examining laboratories). Do you think that people would be happy to lose their laptop for a year over a (comparatively) trivial issue? It would be like having your car impounded for a year if you got a speeding ticket .

[SeaKing]

Originally Posted by HarryT

What sort of evidence did you have in mind? Forensic examination of computers is an extremely time-consuming and expensive process. Are there more practical alternatives?

Let me give you an example.
A retired former CIA operative had an apartment in a hide rise building in Florida that overlooked the bay. One day, the door bell rang, and he opened the door and there were a dozen FBI agents, some with guns drawn and pointed at him. (You see they had checked on who lived there.)
He said something like uh oh, what is going on.
They said "You --name here-- are under arrest for illegal online child pornography trafficking and we have a warrant.
The gentleman said you could have knocked me over with a feather.
It turns out that he was using a unsecured wireless modem and a boat out in the bay about 2 city blocks away was attaching to it using an antenna gadget that concentrates wireless signals. (You can make one fairly easily.)
Of course to make sure the CIA guy wasn't in on it, they checked out his computer, etc. It turns out that child porn people also need a lot of photos to thumb through as well as computer screens, but this might be changing with the advent of tablets.
The gentleman was cleared.

Now if the FBI knocks on my door with a warrant, and comes in and exaimes my computers and my CDs and DVDs, etc., and finds pirated movies, music, and other stuff, then they have me.

Otherwise they only have a ***** lead ***** on a possible problem.

They need to have to do their due diligence and that is before a suit is filed. The crime must be proven and if that is too darned hard, well that is too bad.

[JoeD]

Originally Posted by HarryT

When the police seize a computer for forensic examination, it's not uncommon for the owner to be without it for a year or more (apparently there's a huge backlog at the examining laboratories). Do you think that people would be happy to lose their laptop for a year over a (comparatively) trivial issue? It would be like having your car impounded for a year if you got a speeding ticket .

No I don't. It's not an ideal solution, in fact it's not a very realistic one. However, without police involvement I can't see how an IP can be accepted as sufficient evidence.

We need something in between.

There isn't really a call for a full forensic examination of a PC for IP cases. So perhaps there's a way to fast track police involvement that could allow searches to be carried out on site or images of HDDs take for later examination (might not be allowed if only the original can be used as evidence).

However just because it's currently unreasonable for the police to go seize computers over the accusation of a single mp3 being shared, that doesn't mean we should now allow a lower level of evidence (just the IP) to be grounds for finding someone guilty.

Government needs to look into how they could streamline the involvement of the police. The police could then select the cases where continual infringement is suspected (i.e letters issued and ignored) and act on just those few cases.

[MovieBird]

Originally Posted by HarryT

Do you think that people would be happy to lose their laptop for a year over a (comparatively) trivial issue? It would be like having your car impounded for a year if you got a speeding ticket .

Not so trivial if it potentially will cost upwards of hundreds of thousands of dollars/pounds...

In that case, yes, I think people would be happy to lose a computer for a year in order to prove their innocence.

[HarryT]

Originally Posted by SeaKing

It turns out that he was using a unsecured wireless modem and a boat out in the bay about 2 city blocks away was attaching to it using an antenna gadget that concentrates wireless signals. (You can make one fairly easily.)

I would argue that this is his responsibility. It's negligent to leave a wireless connection unsecured. If the connection is abused as a result, then the owner of the connection should be responsible for that. It's like leaving your car unlocked and the key in the ignition; the police probably won't have too much sympathy for you if it's stolen, and your insurance certainly won't pay out.

[Rob Lister]

Originally Posted by HarryT

I would argue that this is his responsibility. It's negligent to leave a wireless connection unsecured. If the connection is abused as a result, then the owner of the connection should be responsible for that. It's like leaving your car unlocked and the key in the ignition; the police probably won't have too much sympathy for you if it's stolen, and your insurance certainly won't pay out.

You say that he should be held responsible for child porn because he was not technically savvy enough to secure his wifi connection.

You do realize that the majority of folks couldn't tell you the difference between wep and wpa; that the only reason they might have a secured network at all is because they happened to have followed directions when hooking it up, or it came out of the box that way; that they don't have the faintest clue that it would even be an issue.

Do you realize that?

[Shack70]

I think the point here is that the RIAA has tried to sue thousands of people over the years and instead of making an effort to really proove anything they go the other route. Sue 1000 people an hope some of them buckle and pay the fines. The courts are saying knock it off and show us the proof before you waste our time.

[HarryT]

Originally Posted by Rob Lister

You say that he should be held responsible for child porn because he was not technically savvy enough to secure his wifi connection.

Yes, I do. If you don't have the knowledge yourself, get it done by someone who does have the knowledge. We require training and certification before someone is allowed to drive a car. An internet connection is potentially a more "dangerous" thing to possess - should we not require responsibility from its owner?

[MrsJoseph]

Originally Posted by HarryT

Yes, I do. If you don't have the knowledge yourself, get it done by someone who does have the knowledge. We require training and certification before someone is allowed to drive a car. An internet connection is potentially a more "dangerous" thing to possess - should we not require responsibility from its owner?

Wow, Harry. That's super harsh. You'd rather this guy go to jail for something he didn't do because he doesn't understand IP securities?? I have to say that I hope nothing of the sort ever happens to you. And - if by any chance you are unlucky enough for it to happen - I hope that someone has more sympathy for you than you do for others.

[JoeD]

Originally Posted by HarryT

I would argue that this is his responsibility. It's negligent to leave a wireless connection unsecured. If the connection is abused as a result, then the owner of the connection should be responsible for that. It's like leaving your car unlocked and the key in the ignition; the police probably won't have too much sympathy for you if it's stolen, and your insurance certainly won't pay out.

For many years ISPs shipped routers to their customers that were pre configured with open WiFi, customers had no idea it was insecure. Others knew enough to turn on WEP but not enough to know people could break the security of it in a few minutes. Those who knew about WEP were smart enough to turn on WPA (which if they've failed to keep up with geeky tech news, they'll not know it is also breakable in a minute or so and should be running WPA2)

This is one of the reasons I think the first wave of letters is a very good idea. People need to be aware there's a possible problem and either know how to configure the security of their device to fix it OR pay someone to do so. The letter would ensure they're aware and can take the steps needed to check/sort it.

Now chances are the current WPA2 will be eventually broken and hopefully by then there's a new flavour out we can all move to temporarily, but if/when it is, there's going to be a lot of vulnerable wifi connections because people won't know it's broken. Those people should not be responsible for someone cracking and abusing their network and been fined on evidence of nothing more than their IP been used.

[HarryT]

Originally Posted by MrsJoseph

Wow, Harry. That's super harsh. You'd rather this guy go to jail for something he didn't do because he doesn't understand IP securities?? I have to say that I hope nothing of the sort ever happens to you. And - if by any chance you are unlucky enough for it to happen - I hope that someone has more sympathy for you than you do for others.

I'm saying that the need for security should have been beaten into him with a large blunt instrument by whoever sold it to him. If it was, and he chose to ignore it, then it's his responsibility. It is wasn't, it's the responsibility of the supplier.

I recently had a second phone phone installed in my house and got an internet connection on it with the UK's largest ISP (British Telecom). I was very impressed by the emphasis on security that was stressed right from the very start of the ordering process.

[hrosvit]

As a bit of background, I am a police officer, and specifically, a forensic computer examiner. A large portion of my work is identifying traders of illegal files online, serving search warrants on their residences, seizing their computers and examining them, and filing appropriate charges. IN A CRIMINAL CASE, if I can't put a specific human being behind the keyboard (by means of an admission, internet history, other files, etc.), no one gets arrested.

I realize that civil cases have a different burden of proof. I am, by no means, an expert at civil law. However, there has to be some method of identifying an actor. Saying "someone used your internet connection to trade copyrighted material" does not come anywhere close to establishing resposibility. You can say that a person is being negligent if he fails to secure his network. I don't agree that this is grounds for conviction, but I'll let that go for now. Even if you secure your network, it is not a very complex task to hack a protected wireless network. So if your network is hacked, are you still responsible?

I have personally experienced (more than once) receiving incorrect subscriber information from internet service providers for IP logs (and no, they are not obligated by law to maintain logs for any specific amount of time). So, without corroborating evidence, merely the fact that an ISP provided subscriber information is nowhere near sufficent for conviction.

And what about deliberately open networks? If I go to Panera, or Starbucks, or McDonalds, or the public library, and download copyrighted material, does that mean the RIAA/MPIAA/whomever can now go after McDonalds? For a while, the city of Philadelphia was planning to install a free wireless network for the entire city (boy, is that a terrible idea). In that case, if I had been anywhere in Philadelphia downloading copyrighted material, can the city be held responsible for the act? Or, more in depth, do you know who actually owns the network at most McDonalds? AT&T; they own more than 100,000 free public wireless networks in the US. Why? To get mobile users off their cellular network, and onto wifi, thereby reducing the load on their cellular network. So, if I download copyrighted material at McDonalds, can AT&T be held responsible? I'd actually like to see the RIAA/MPIAA/Publishers go after AT&T. Obviously, this wouldn't happen, but it would be entertaining to watch.

The bottom line is that although piracy is bad, and we should attempt to pursue it and stop it, this is not a viable solution. IP address does not equal bad guy.

[HarryT]

Oh well, given that the law appears to favour your viewpoint, I guess you don't have to worry too much about my warped views about the way the world should be becoming a reality, do you? It concerns me deeply, though, that the criminal appears to be being given a "get out of jail free" card here. "Oh it wasn't me, officer. Someone else must have used my IP connection!".

[Shack70]

Originally Posted by hrosvit

And what about deliberately open networks? If I go to Panera, or Starbucks, or McDonalds, or the public library, and download copyrighted material, does that mean the RIAA/MPIAA/whomever can now go after McDonalds? For a while, the city of Philadelphia was planning to install a free wireless network for the entire city (boy, is that a terrible idea). In that case, if I had been anywhere in Philadelphia downloading copyrighted material, can the city be held responsible for the act? Or, more in depth, do you know who actually owns the network at most McDonalds? AT&T; they own more than 100,000 free public wireless networks in the US. Why? To get mobile users off their cellular network, and onto wifi, thereby reducing the load on their cellular network. So, if I download copyrighted material at McDonalds, can AT&T be held responsible? I'd actually like to see the RIAA/MPIAA/Publishers go after AT&T. Obviously, this wouldn't happen, but it would be entertaining to watch.

The bottom line is that although piracy is bad, and we should attempt to pursue it and stop it, this is not a viable solution. IP address does not equal bad guy.

Those companys have money to defend themselves and are not easy wins for the RIAA

[hrosvit]

Originally Posted by Shack70

Those companys have money to defend themselves and are not easy wins for the RIAA

That's exacly why it would never happen, and also exactly why it would be entertaining.